CVE-2021-32745: Reflected Cross-Site-Scripting vulnerability
Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-5. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time. The issue is patched in Collabora Online 6.4.9-5. Collabora Online 4.2 is not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32745?
The severity of CVE-2021-32745 is classified as medium due to its reflected XSS nature.
How do I fix CVE-2021-32745?
To fix CVE-2021-32745, upgrade Collabora Online to version 6.4.9-5 or later.
What types of attacks are possible with CVE-2021-32745?
CVE-2021-32745 allows attackers to perform reflected XSS attacks by injecting unescaped HTML into Collabora Online iframes.
Which versions of Collabora Online are affected by CVE-2021-32745?
Collabora Online versions prior to 6.4.9-5 are vulnerable to CVE-2021-32745.
What is reflected XSS as noted in CVE-2021-32745?
Reflected XSS in CVE-2021-32745 refers to an attack where malicious scripts are executed in the user's browser after receiving untrusted input.